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Watchdog timer circuit 




(57) 


A watchdog timer circuit (10) includes a cyclic 


(10) includes a feature for selectivity supplanting the 



counter (18) with an overflow signal that functions as a 
reset pulse to a microprocessor (12). The timer circuit 



overflow signal to enable in situ programming of the mi- 
croprocessor (12). 



CM 

< 

O) 
O) 
CO 

CO 
00 



FfG. 2 



<3 



13 



12- 



2_ 



(TO SYSTEM FUNCTIONS) 



10 



I. 



MICROPROCESSOR 



CHANGE DIRECTION 



MSB 
RESET 
CLK IN 



+ 5V 



22- 




25K 



-48 



r 0.0f/if 



TIMER 
DIS 



TRIG 
THR 
CONT 



OUT 



51- 



I55> 



BUFFER 
OUT IN 



-54 



BUFFER 
OUT IN 
U 



^58 



57 



59 — 



44 



1 



32-, 



PROG CLOCK 



34-5 



40 



PROG RESET 
J 



BUFFER 
IN OUT 



k 50 



==0.0l/if 



52^ 
18- 

28_ 



COUNTER 
UP/ DOWN 



CLK 



OVERFLOW 



MSB 



— 42 



24- 



MODE SELECT 



NORMAL 
CLOCK 



J2 



26 



MULTIPLEXER 

CLK(NORM) 
CLK(PROG) 

RESET (PROG) 
RESET (NORM) 
PROG SELECT 
CLK OUT 
RESET OUT 



-56 



53 J 



CL 
LU 



Printed by Jouve. 75001 PARIS (FR) 



1 



EP 0 831 399 A2 



2 



Description 

The present invention relates to microprocessor 
control circuits, and more specifically to watchdog timer 
circuits for supervising microprocessor operation. 5 

The use of watchdog circuits to monitor the opera- 
tion of microprocessors and to reset them in the event 
of aberrant operation is well known. Such circuits pro- 
vide the reset command necessary to ensure that a mi- 
croprocessor returns to a known reference point after a 10 
failure in order to resume a designated manner of oper- 
ation. 

Failure of a microprocessor to perform correctly 
during normal operation is typically a result of, though 
not limited to, any of three situations. The first is external is 
electromagnetic interference (EMI), which can cause 
the power being supplied to a microprocessor to fluctu- 
ate, whereby the microprocessor produces unpredicta- 
ble results. Secondly, external radiation, such as that 
found in outer space, can cause single event upsets 20 
(SEU) that also result in erratic operations. Finally, er- 
rors may also follow from unanticipated software bugs. 
These types of situations may cause erratic operation 
to occur at random intervals or continuously for extend- 
ed periods of time. Thus, there is a need to reset micro- 25 
processors not only when a discrete interruption occurs 
but also to reset them continuously in the event of a pro- 
longed interruption. 

Furthermore, such resets often must occur quickly 
after a microprocessor enters an errant state of opera- 30 
tion to prevent potentially hazardous or even fatal con- 
sequences, such as with use in an alarm system. Addi- 
tionally, when power is supplied to microprocessors they 
are in undefined states of operation. Thus, an initializa- 
tion or power-on reset is also necessary to ensure that 35 
a microprocessor will begin its designated mode of op- 
eration at the outset. 

Accordingly, it is desirable to have a watchdog timer 
with the following features: a continuous reset for re- 
peatedly resetting the microprocessor as necessary to *o 
return it to a normal state of operation; a quick response 
window to ensure that the microprocessor is reset quick- 
ly; and a power-on reset (POR) to reset the microproc- 
essor following the initial application of electrical power. 

The prior art does not teach how to combine these *s 
features within a single watchdog timer circuit. For in- 
stance, Younger (U.S. Pat. No. 5,341,497) discloses a 
circuit for detecting an anomalous operating state of a 
microprocessor that continually resets the microproces- 
sor until a specified number of resets occurs, at which so 
point an alarm is tripped. Younger further provides a lim- 
ited response window feature for generating a reset up- 
on occurrence of an errant state. However, Younger 
does not teach a method for implementing a POR fea- 
ture. In like manner, Huang et al. (U.S. Pat. No. 55 
4,627,060) discloses a watchdog timer with a limited re- 
sponse window feature and a POR feature, but no con- 
tinuous reset feature. 



In addition to the failure of the prior art watchdog 
timers to combine all of the above features in a single 
device, the current state of the art also does not allow 
the disabling of any of these features once they are in 
place. Current watchdog circuits constantly maintain 
control over their microprocessor reset inputs whenever 
power is supplied to the system. Yet, there are discre- 
tionary microprocessor functions which also must have 
access td the microprocessor reset input if they are to 
be performed, such as the ability to re-program micro- 
processors to perform alternate tasks. 

As a result of this limitation, re-programming is typ- 
ically conducted by physically removing the microproc- 
essor from its circuit board and associated watchdog cir- 
cuitry and placing it in a commercially available pro- 
gramming device. The programming device can then 
access the microprocessor reset without interference 
from the watchdog circuitry. 

However, off-board programming can be problem- 
atic as well as time and labor intensive for numerous 
reasons. Microprocessors are typically the largest of all 
integrated circuits (IC) and accordingly have the most 
input and output (I/O) pins of all ICs. The delicate nature 
of the I/O pins requires meticulous handling to avoid 
damage thereof. Also, microprocessors are fastened to 
a circuit board by placing the I/O pins through tiny holes 
in the board and soldering the pins in place. Here again, 
the delicate I/O pins can be damaged from this fastening 
and unfastening. 

The microprocessor, circuit board, and other circuit 
components can also be damaged during fastening and 
unfastening by the heat source required for soldering. 
Accordingly, the solder must be applied and removed 
from these pins with a narrowly focused heat source. 
Since microprocessors may have several hundred I/O 
pins, it becomes cumbersome to carefully remove the 
soldering from each of these pins. Additionally, ICs are 
susceptible to electrostatic discharge and can be dam- 
aged as a result thereof. Thus, it is desirable to handle 
these chips as little as possible so as to reduce the 
chances of such thermal and electrostatic damage. 

Accordingly, there is a need for a watchdog timer 
that can be disengaged from microprocessor reset in- 
puts, thereby allowing remote access to a microproces- 
sor for in situ programming thereof. 

It is therefore an object of the present invention to 
provide an improved watchdog timer circuit that incor- 
porates the features of a continuous reset, a quick re- 
sponse window, and a power-on reset. It is a further ob- 
ject of the present invention to provide such an improved 
watchdog timer with the additional feature of being able 
to be selectively disabled, thereby permitting a user ex- 
ternal access to the reset input of a microprocessor for 
in situ programming of same. 

According to the present invention, an improved 
watchdog timer circuit is provided that includes a cyclic 
counter with an overflow bit for counting pulses provided 
by a timer. The counter alternately increments and dec- 
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rements an output counter in response to a periodic 
command signal from the microprocessor. The failure of 
the microprocessor to provide this command signal 
causes the counter to set the overflow bit, which resets 
the microprocessor. The overflow bit is continuously set 
as the counter cycles through its maximum count as 
long as the microprocessor fails to provide the com- 
mand signal, thereby providing a continuous reset to the 
microprocessor. The overflow bit of the counter will also 
be set upon application of power to the microprocessor, 
thereby providing a power-on reset to the microproces- 
sor. 

The size of said counter and frequency of said timer 
are chosen such that the duration between reset pulses 
is both long enough to afford the microprocessor ade- 
quate time to prohibit the reset and yet still short enough 
to cause the microprocessor to reset quickly after enter- 
ing an aberrant state, thereby providing a quick re- 
sponse window. 

In further accord with the present invention, the ap- 
paratus includes a multiplexer for selectively electrically 
connecting either the overflow bit of said counter (the 
"normal reset") or an external programming reset signal 
to the microprocessor, thereby enabling in situ program- 
ming thereof. 

According to a preferred feature of the invention, the 
timer provides continuous timing pulses upon applica- 
tion of electrical power thereto and the counter continu- 
ally counts in response to the timing pulses. Thus, the 
counter repeatedly overflows when the microprocessor 
is in an aberrant operating mode. This causes a power- 
on reset when the microprocessor initializes in an errant 
state following application of power thereto and a con- 
tinuous reset when the microprocessor remains in an 
aberrant operational state for extended temporal peri- 
ods. 

According to another preferred feature, the frequen- 
cy of the timer and the count capacity of the counter are 
selected such that when used in conjunction the interval 
preceding generation of the overflow by the counter is 
longer than the interval at which the microprocessor val- 
idates its operational state, yet short enough to provide 
a quick response window from the instant when the mi- 
croprocessor enters a state of aberrant operation until 
the instant when the overflow signal is generated. 

Preferably, the counter further comprises an upper 
counting limit and a lower counting limit and generates 
the overflow signal upon surpassing either counting lim- 
it. 

In a preferred embodiment, the microprocessor is 
programmed to provide, in response to the count of the 
counter, a command signal adapted to cause the count 
direction of the counter to reverse so as to prevent said 
counter from generating the overflow signal. 

The command signal of the microprocessor may be 
provided in response to a most significant bit of the count 
of the counter. 

These and other objects, features, and advantages 



of the present invention will become more apparent in 
light of the following detailed description of an exempla- 
ry embodiment thereof, as illustrated in the accompany- 
ing drawings, in which: 

5 

FIG. 1 is a simplified system block diagram of a best 
mode embodiment of a watchdog timer according 
to the present invention; 

FIG. 2 is a detailed schematic of the watchdog timer 
10 of FIG. 1; 

FIG. 3 is a flow diagram depicting the operational 
steps associated with the operation of the watchdog 
timer of FIG. 1; and 

FIG. 4 is timing diagram depicting the operational 
is flow of the embodiment of FIG. 1 . 

FIG. 1 is a simplified system block diagram of the 
watchdog timer circuit 10 of the present invention for su- 
pervising a microprocessor 12. In the present embodi- 
20 ment, the microprocessor 1 2 is an Intel 87C51 -1 6. How- 
ever, the present invention could be utilized with other 
microprocessors, as would be evident to those of ordi- 
nary skill in the art. The input and output lines of the 
microprocessor 12 are generically denoted by an arrow 
2S 1 3 leading to system functions, as they are not utilized 
by watchdog timer circuit 10 and accordingly do not re- 
quire further description here. 

A timer 14 provides a serial timing pulse signal on 
a line 16 to a counter 18. The counter 18 continually in- 
30 crements or decrements the current count stored in its 
register at the frequency of the timing pulses supplied 
by the timer 14. Unless otherwise prevented by the mi- 
croprocessor 1 2 from reaching the upper or lower count- 
ing limit, the counter 18 pulses its overflow bit, resets its 
35 internal register, and begins counting again toward the 
counting limit. 

In normal operation, the microprocessor 12 pre- 
vents the counter 18 from overflowing by monitoring, 
through a line 20, the status of the most significant bit 
40 (MSB) of the word stored in the register of the counter 
18. As described in detail hereinafter, based upon the 
MSB status, the microprocessor 12 periodically in- 
structs the counter 18 to change its counting direction 
through a line 22. In this manner, the microprocessor 1 2 
45 prevents the counter 18 from reaching its upper or lower 
counting limit, thereby averting an overflow signal 
through a line 24 to a multiplexer 26. 

The reason for monitoring the MSB, as opposed to 
a lesser significant bit, is that when the MSB goes from 
50 a low state to a high state the current count is half-way 
between the upper and lower counting limits of the coun- 
ter. Thus, the microprocessor 12 has an equal amount 
of counts to avoid an overflow regardless of which 
counting limit will be surpassed next. 
55 }n the present invention, a user mode select signal 
28 is provided by an operator to the multiplexer 26 
though a line 30. The select signal 28 has two states: a 
normal mode which causes the watchdog timer circuit 
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10 to operate in the normal mode; and a programming 
mode, described hereinafter. The multiplexer 26 con- 
nects the counter's overflow bit on the line 24 and a nor- 
mal mode clock 32 on a line 34 to the microprocessor 
12 through lines 36 and 38, respectively. When the user 
mode select signal 28 is set for the programming mode, 
the multiplexer 26 disconnects the counter's overflow bit 
and the normal clock signal from the microprocessor 
and replaces them with a programming reset signal 40 
on a line 42 and a programming clock signal 44 on a line 
46. Again, the programming reset signal 40 and pro- 
gramming clock signal 44 pass through the multiplexer 
26 and enter the microprocessor 1 2 on lines 36 and 38, 
respectively. 

FIG. 2 is a detailed schematic illustration of the 
watchdog timer 10 of FIG. 1. The timer 14 is a known 
type counter, such as a Signetics 555 timer 48 (model 
555/BCA(MIL)), with external resistors and capacitors 
9A-49D which are configured to provide a time constant 
such that a continuous timing pulse of 250 microsecond 
period (frequency of 4 KHz) is provided through a line 
50, a buffer 51 , and a line 52 to the counter 1 8. The buff- 
er 51 is a known device, such as a Schmitt trigger, Na- 
tional Semiconductor model 54AC14, used to ensure 
proper input drive level to the counter 18. Equivalents 
for generating a timing pulse train, as known to those of 
ordinary skill in the art, would also suffice. 

The timing pulses enter the counter 18, which in a 
best mode embodiment comprises a 4-bit National 
Semiconductor 54AC169, and subsequently increment 
or decrement the count stored in its internal register. As 
a 4 bit counter, the counter 18 thus allows the micro- 
processor 12 a maximum of 16 counts before an over- 
flow condition occurs, or a maximum allowable re- 
sponse window of 4 milliseconds (obtained from multi- 
plying 1 6 counts and the 250 microsecond timing pulse). 
This would be the case during a POR, where the counter 
would count through its entire cycle before overflowing 
and resetting microprocessor 12. 

However, during normal operation, the counter will 
normally dither around the decimal number ^"(or binary 
" 1 000"), where the MSB changes state, thus the counter 
18 will only allow the microprocessor 12 approximately 
8 counts before an overflow condition occurs, or a re- 
sponse window of 2 milliseconds (obtained from multi- 
plying 8 counts and the 250 microsecond timing pulse). 

The microprocessor 12 chooses the current count 
direction based upon the status of the MSB of the word 
stored in the counter 18. If the MSB is in a logic high 
position, the microprocessor 12 will send a count down 
signal (logic zero), on the line 22, to the counter 18 until 
the MSB is logic zero. If the MSB is not in a logic high 
position, the microprocessor 1 2 will send a count up sig- 
nal (logic high) to the counter until the MSB is set. The 
MSB signal enters microprocessor 12 through a line 53, 
a buffer 54 (again, a Schmitt trigger 54AC14 to ensure 
proper input drive level to the microprocessor 1 2), and 
a line 55. 



In the present embodiment, the count up and count 
down signals are implemented by setting the count di- 
rection to be the inverse of the MSB. Also, the micro- 
processor is programmed to check the MSB status eve- 

5 ry millisecond, or once every 1 6,000 clock pulses of the 
16 MHz normal system clock 32. Thus, the microproc- 
essor 12 is programmed in the present embodiment to 
check the MSB at half of the interval it will take the coun- 
ter 18 to overflow during normal operation. Equivalent 

10 variations for generating the count change direction sig- 
nal, as well as different variations of the timing intervals 
mentioned herein, could also be used. 

When the watchdog timer circuit 10 is operating in 
normal mode, the multiplexer 26 (shown as a National 

15 Semiconductor 54AC157, or equivalent) passes the 
overflow signal directly to the reset input of the micro- 
processor 12 through a line 56, a buffer 57 (here again, 
a Schmitt trigger 54AC14 to ensure proper input drive 
level to the microprocessor 12), and a line 58. The nor- 

20 mal mode occurs when the mode select signal 28 is set 
to a logic zero. The normal mode clock signal 32, pro- 
vided by a 16 MHz CTS model CTX116 oscillator, or 
equivalent, is also passed directly through the multiplex- 
er 26 to the clock input of the microprocessor 12 on a 

25 line 59 during normal mode. 

However, when the program mode select signal 28 
is set to logic high, meaning that the watchdog timer cir- 
cuit 10 is in the programming mode, a programming re- 
set signal 40 is passed on a line 42 to the multiplexer 

30 26, where it then passes on the 56, the buffer 57, and 
the line 58 to the reset input of the microprocessor 12. 
Likewise, a program clock signal 44, a 5 MHz clock sig- 
nal as required by the manufacturer for programming a 
87C51-16, passes through the multiplexer 26 in place 

35 of the normal clock 32 to the clock input of the micro- 
processor 12 on the line 59. 

The logic components noted above are CMOS logic 
devices of the 54AC family because they are compatible 
with the microprocessor used in the present embodi- 

40 ment. Though clock 32 is a TTL device in the present 
embodiment, it will sufficiently drive the 54AC logic with- 
out external pull-up resistors or further modification. 
Equivalent logic families and devices could be inter- 
changed for those mentioned herein, as used in accord- 

45 ance with the requirements of a given host microproc- 
essor and as would be evident to one of ordinary skill in 
the art. 

FIG. 3 is a flow diagram depicting the counter 
checking program of the microprocessor 12 of FIG.1. 

50 The microprocessor 1 2 first enters the counter checking 
program, denoted by entry block 60. The next order of 
operation is to determine if the MSB of the counter 18 
has reached logic high, which is shown by decision 
block 61. If the MSB is found not to be logic high, the 

55 microprocessor 1 2 sends a count up (logic zero) signal 
to the counter 1 8, as seen in an operation block 62, and 
exits the counter checking program, as shown by an exit 
block 63. If the MSB is found to be logic high, the micro- 
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processor 12 sends a count down signal to the counter 
18, as depicted in an operation block 64, and exits the 
counter checking program, again shown by the exit 
block 63. This process would repeat at one millisecond 
intervals thereafter. 

FIG. 4 is a timing diagram which further illustrates 
the operational flow of the watchdog timer circuit 10 of 
FIG. 1 . FIG. 4 illustration (a) shows a timing pulse signal 
66, the 250 millisecond timing pulse generated by the 
timer 14. FIG. 4 illustration (b) shows a MSB 68, the 
most significant bit of the word stored in the counter 18, 
which corresponds to the decimal value "8" when set 
high. FIG. 4 illustration (c) shows a second MSB 70, the 
second most significant bit of the word stored in the 
counter 18, which corresponds to the decimal value "4" 
when set high. FIG. 4 illustration (d) shows a third MSB 
72, the third most significant bit of the word stored in the 
counter 18, which corresponds to the decimal value "2" 
when set high. FIG. 4 illustration (e) shows a least sig- 
nificant bit (LSB) 74, the least significant bit of the word 
stored in the counter 18, which corresponds to the dec- 
imal value "1" when set high. Furthermore, FIG. 4 illus- 
tration (f) shows the overflow reset signal 76 of the coun- 
ter 18, where a logic high pulse represents a reset in- 
struction. Finally, FIG. 4 illustration (g) shows the count 
direction 78 of the counter 18, where a logic high signal 
indicates a count up command and a logic low signal 
indicates a count down command. 

Along with the various illustrations of FIG. 4 are tem- 
poral reference points generally indicated by letters A- 
I. At t=0, the current count of the counter 18 is decimal 
"7" and is incrementing, as shown by the count direction 
78. At point A microprocessor 12 has detected that the 
MSB 68 is set and changes the count direction 78 to 
count down. By point B the count has decremented to 
decimal "7" whereby MSB 68 is no longer high. 

At point C the microprocessor 12 detects that the 
MSB 68 is no longer high, causing the count direction 
78 to change to the count up position. Point D is when 
the effect of the count change at point C takes effect, 
causing the MSB 68 to go high. Shortly after point D, a 
fault condition occurs which fixes the count direction 78 
in the increment position and renders the microproces- 
sor 12 unable to change the count direction 78. The 
counter 1 8 continues to increment the current count until 
point E, when the count surpasses the maximum allow- 
able counting limit (decimal "1 5") and the overflow reset 
signal 76 pulses high, causing microprocessor 12 to re- 
set. 

The counter 18 continues to increment thereafter 
from zero up until point F, where the count becomes dec- 
imal "8 B and the MSB 68 is once again set high. At point 
G, microprocessor 12 has determined that the MSB 68 
is high and accordingly sets the count direction 78 low, 
causing the counter 18 to count down. At point H, the 
MSB 68 falls low, and at point I the microprocessor 1 2 
determines that the MSB 68 is no longer high and 
changes the count direction 78. The above described 



process would then continue repeatedly until another er- 
ror condition occurred. 

Although the invention has been shown and de- 
scribed with respect to a best mode embodiment there- 
5 of, it should be understood by those skilled in the art that 
various changes, omissions, and additions may be 
made to the form and detail of the disclosed embodi- 
ment without departing from the scope of the invention 
as recited in the following claims. 



Claims 

1. A watchdog timer circuit (10) for monitoring a micro- 
15 processor (12) and resetting the microprocessor 

upon detection of aberrant operation that allows in 
situ programming of the microprocessor, the circuit 
(10) comprising: 

20 a timer (14) for generating timing pulses of 

specified frequency; 

a cyclic counter (18) with an overflow bit which 
functions as a reset pulse to the microproces- 
sor (12), the counter (18) being of the type for 
25 incrementing or decrementing a stored count in 

accordance with the pulses of said timer (14); 
and 

a switching means (26) for selectively supplant- 
ing the overflow signal of said counter with an 
30 external programming reset signal to enable in 

situ programming of the microprocessor (12). 

2. The watchdog timer circuit (10) of claim 1 , wherein 
said timer (14) provides continuous timing pulses 

35 upon application of electrical power thereto and 
said counter (18) continually counts in response to 
the timing pulses, whereby said counter (18) re- 
peatedly overflows when the microprocessor (12) 
is in an aberrant operating mode, thereby causing 

40 a power-on reset when the microprocessor initializ- 
es in an errant state following application of power 
thereto and a continuous reset when the microproc- 
essor remains in an aberrant operational state for 
extended temporal periods. 

45 

3. The watchdog timer circuit of claim 1 or 2, wherein 
the frequency of said timer (14) and the count ca- 
pacity of said counter (18) are selected such that 
when used in conjunction the interval preceding 

50 generation of the overflow by said counter is longer 
than the interval at which the microprocessor (12) 
validates its operational state, yet short enough to 
provide a quick response window from the instant 
when the microprocessor (12) enters a state of ab- 

55 errant operation until the instant when the overflow 
signal is generated. 

4. The watchdog timer circuit (10) of any preceding 
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claim, wherein said counter (18) further comprises 
an upper counting limit and a lower counting limit 
and generates the overflow signal upon surpassing 
either counting limit. 

5 

The watchdog timer circuit (10) of any preceding 
claim, wherein the microprocessor (12) is pro- 
grammed to provide, in response to said count of 
said counter (18), a command signal adapted to 
cause the count direction of said counter to reverse 10 
so as to prevent said counter from generating said 
overflow signal. 

The watchdog timer circuit (10) of claim 5, wherein 
said command signal of the microprocessor (12) is 75 
provided in response to a most significant bit of said 
count of said counter (18). 

A watchdog timer circuit (10) comprising a cyclic 
counter (1 8) with an overflow bit for counting pulses 20 
provided by a timer (14), wherein: the counter (18) 
is arranged to either increment or decrement, in re- 
sponse to a command signal from a microproces- 
sor, a stored count on receipt of a pulse from the 
timer (1 4); the overflow bit of the counter (1 8) is set 25 
if, due to the absence of the command signal, the 
stored count exceeds a maximum or minimum val- 
ue; and the setting of the overflow bit causes the 
microprocessor (12) to reset. 

30 

The watchdog timer circuit (10) of claim 7, having 
the features of one or more of claims 1 to 6. 
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